contrast-agent 3.13.2 → 4.1.0

data/lib/contrast/agent/assess/policy/propagator/splat.rb

@@ -17,11 +17,11 @@ module Contrast
                 propagation_node.sources.each do |source|
                   case source
                   when Contrast::Utils::ObjectShare::OBJECT_KEY
-                    tracked_inputs << preshift.object if preshift.object.cs__tracked?
+                    tracked_inputs << preshift.object if Contrast::Agent::Assess::Tracker.tracked?(preshift.object)
                   else
                     arg = preshift.args[source]
                     if arg.is_a?(String)
-                      tracked_inputs << arg if arg.cs__tracked?
+                      tracked_inputs << arg if Contrast::Agent::Assess::Tracker.tracked?(arg)
                     elsif Contrast::Utils::DuckUtils.iterable_hash?(arg)
                       arg.each_pair do |key, value|
                         tracked_inputs << key if tracked_value?(key)
@@ -36,19 +36,20 @@ module Contrast
                 end
 
                 splat_tags(tracked_inputs, target)
-                target.cs__properties.cleanup_tags
+                Contrast::Agent::Assess::Tracker.properties(target).cleanup_tags
               end
 
               def splat_tags tracked_inputs, target
                 return if tracked_inputs.empty?
 
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
+
                 tracked_inputs.each do |input|
-                  unless input == target
-                    input.cs__properties.events.each do |event|
-                      target.cs__properties.events << event
-                    end
-                  end
-                  input.cs__splat_tags(target)
+                  input_properties = Contrast::Agent::Assess::Tracker.properties(input)
+                  next unless input_properties
+
+                  properties.splat_from(input, target)
                 end
               end
             end

data/lib/contrast/agent/assess/policy/propagator/split.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/preshift'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/thread_tracker'
+require 'contrast/agent/assess/policy/preshift'
+require 'contrast/components/interface'
+require 'contrast/utils/thread_tracker'
 
 module Contrast
   module Agent
@@ -36,6 +36,8 @@ module Contrast
                              target_id: target.__id__)
                 unless target.is_a?(Array)
                   Contrast::Agent::Assess::Policy::Propagator::Keep.propagate(propagation_node, preshift, target)
+                  properties = Contrast::Agent::Assess::Tracker.properties(target)
+                  properties.build_event(propagation_node, target, object, ret, args)
                   return
                 end
 
@@ -53,17 +55,17 @@ module Contrast
                 target.each do |elem|
                   elem_length = elem.length
                   range = current_index...(current_index + elem_length)
-                  tags = source.cs__properties.tags_at_range(range)
+                  elem_properties = Contrast::Agent::Assess::Tracker.properties(elem)
+                  next unless elem_properties
 
-                  elem.cs__properties.clear_tags
+                  source_properties = Contrast::Agent::Assess::Tracker.properties(source)
+                  tags = source_properties.tags_at_range(range)
+                  elem_properties.clear_tags
                   tags.each_pair do |key, value|
-                    elem.cs__properties.set_tags(key, value)
+                    elem_properties.set_tags(key, value)
                   end
-                  source.cs__properties.events.each do |event|
-                    elem.cs__properties.add_event(event)
-                  end
-                  elem.cs__properties.build_event(propagation_node, elem, preshift.object, target, preshift.args, 0)
-                  elem.cs__properties.add_properties(propagation_node.properties)
+                  elem_properties.build_event(propagation_node, elem, preshift.object, target, preshift.args, 0)
+                  elem_properties.add_properties(propagation_node.properties)
                   current_index = current_index + elem_length + separator_length
                 end
                 nil
@@ -125,8 +127,11 @@ module Contrast
                 index = SPLIT_TRACKER.get(:split_index)&.fetch(depth)
                 return unless index
 
+                properties = Contrast::Agent::Assess::Tracker.properties(target)
+                return unless properties
+
                 true_source = source[index]
-                target.cs__copy_from(true_source)
+                properties.copy_from(true_source, target)
               rescue StandardError => e
                 logger.warn('Unable to track within split context', e)
               ensure
@@ -139,12 +144,12 @@ module Contrast
               def instrument_string_split
                 if @_instrument_string_split.nil?
                   @_instrument_string_split = begin
-                                                cs__scoped_require 'cs__assess_yield_track/cs__assess_yield_track' if AGENT.patch_yield? && Funchook.available?
-                                                true
-                                              rescue StandardError => e
-                                                logger.error('Error loading split rb_yield patch', e)
-                                                false
-                                              end
+                    require 'cs__assess_yield_track/cs__assess_yield_track' if AGENT.patch_yield? && Funchook.available?
+                    true
+                  rescue StandardError => e
+                    logger.error('Error loading split rb_yield patch', e)
+                    false
+                  end
                 end
                 @_instrument_string_split
               end
@@ -191,10 +196,10 @@ module Contrast
               #   String#split node
               def split_node
                 @_split_node ||= begin
-                                   Contrast::Agent::Assess::Policy::Policy.instance.propagators.find do |node|
-                                     node.class_name == 'String' && node.method_name == :split && node.instance_method?
-                                   end
-                                 end
+                  Contrast::Agent::Assess::Policy::Policy.instance.propagators.find do |node|
+                    node.class_name == 'String' && node.method_name == :split && node.instance_method?
+                  end
+                end
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/substitution.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/duck_utils'
+require 'contrast/components/interface'
+require 'contrast/utils/duck_utils'
 
 module Contrast
   module Agent
@@ -46,22 +46,28 @@ module Contrast
 
                 begin
                   source = preshift.object
-                  self_tracked = Contrast::Utils::DuckUtils.quacks_to?(source, :cs__tracked?) &&
-                      source.cs__tracked?
+                  self_tracked = Contrast::Agent::Assess::Tracker.tracked?(source)
                   args = preshift.args[1]
                   incoming_tracked = args && determine_tracked(args)
                   return ret unless self_tracked || incoming_tracked
 
+                  parent_events = []
                   if block
                     block_sub(self_tracked, source, ret)
                   elsif args.is_a?(String)
-                    string_sub(self_tracked, preshift, ret, args, incoming_tracked, global)
+                    string_sub(parent_events, self_tracked, preshift, ret, args, incoming_tracked, global)
                   elsif args.is_a?(Hash)
                     hash_sub(self_tracked, source, ret)
                   else # Enumerator, only for gsub
-                    pattern_gsub(preshift, ret)
+                    pattern_gsub(parent_events, preshift, ret)
                   end
-                  string_build_event(patcher, preshift, ret)
+
+                  if self_tracked
+                    source_properties = Contrast::Agent::Assess::Tracker.properties(source)
+                    parent_event = source_properties&.event
+                    parent_events.prepend(parent_event) if parent_event
+                  end
+                  string_build_event(parent_events, patcher, preshift, ret)
                 rescue StandardError => e
                   logger.error('Unable to apply gsub propagator', e)
                 end
@@ -73,18 +79,26 @@ module Contrast
                 return false unless args
 
                 # if it's a string, just ask if it's tracked
-                if args.is_a?(String)
-                  Contrast::Utils::DuckUtils.quacks_to?(args, :cs__tracked?) && args.cs__tracked?
+                case args
+                when String
+                  Contrast::Agent::Assess::Tracker.tracked?(args)
                   # if it's a hash, ask if it has a tracked string
-                elsif args.is_a?(Hash)
-                  args.values.any? { |value| value.is_a?(String) && Contrast::Utils::DuckUtils.quacks_to?(value, :cs__tracked?) && value.cs__tracked? }
+                when Hash
+                  args.values.any? { |value| value.is_a?(String) && Contrast::Agent::Assess::Tracker.tracked?(value) }
                   # this should never happen
                 else
                   false
                 end
               end
 
-              def string_sub self_tracked, preshift, ret, incoming, incoming_tracked, global
+              def string_sub parent_events, self_tracked, preshift, ret, incoming, incoming_tracked, global
+                properties = Contrast::Agent::Assess::Tracker.properties(ret)
+                return unless properties
+
+                incoming_properties = Contrast::Agent::Assess::Tracker.properties(incoming)
+                parent_event = incoming_properties&.event
+                parent_events << parent_event if parent_event
+
                 pattern = preshift.args[0]
                 source = preshift.object
 
@@ -92,13 +106,13 @@ module Contrast
                 # copied from regexp / captures. Trading accuracy for
                 # performance
                 if incoming.match?(CAPTURE_GROUP_REGEXP) || incoming.match?(CAPTURE_NAME_REGEXP)
-                  source.cs__splat_tags(ret) if self_tracked
+                  properties.splat_from(source, ret) if self_tracked
                   return
                 end
 
                 # if it's just a straight insert, that we can do
                 # Copy the tags from us to the return
-                ret.cs__copy_from(source)
+                properties.copy_from(source, ret)
                 # Figure out where inserts occurred
                 last_idx = 0
                 ranges = []
@@ -113,54 +127,57 @@ module Contrast
                   ranges << (start_index...end_index)
                   break unless global
                 end
-                ret.cs__properties.delete_tags_at_ranges(ranges)
-                ret.cs__properties.shift_tags(ranges)
+                properties.delete_tags_at_ranges(ranges)
+                properties.shift_tags(ranges)
                 return unless incoming_tracked
+                return unless incoming_properties
 
-                tags = incoming.cs__properties.tag_keys
+                tags = incoming_properties.tag_keys
                 ranges.each do |range|
                   tags.each do |tag|
-                    ret.cs__properties.add_tag(tag, range)
+                    properties.add_tag(tag, range)
                   end
                 end
               end
 
               def block_sub self_tracked, source, ret
-                source.cs__splat_tags(ret) if self_tracked
+                properties = Contrast::Agent::Assess::Tracker.properties(ret)
+                properties&.splat_from(source, ret) if self_tracked
               end
 
               def hash_sub self_tracked, source, ret
-                source.cs__splat_tags(ret) if self_tracked
+                properties = Contrast::Agent::Assess::Tracker.properties(ret)
+                properties&.splat_from(source, ret) if self_tracked
               end
 
-              def pattern_gsub preshift, ret
-                return unless Contrast::Utils::DuckUtils.trackable?(ret)
+              def pattern_gsub parent_events, preshift, ret
+                properties = Contrast::Agent::Assess::Tracker.properties(ret)
+                return unless properties
 
                 source = preshift.object
-                source.cs__properties.tag_keys.each do |key|
-                  ret.cs__properties.add_tag(key, 0...1)
+                source_properties = Contrast::Agent::Assess::Tracker.properties(source)
+                return unless source_properties
+
+                source_properties.tag_keys.each do |key|
+                  properties.add_tag(key, 0...1)
                 end
+                parent_event = source_properties.event
+                parent_events << parent_event if parent_event
               end
 
-              def string_build_event patcher, preshift, ret
-                return unless Contrast::Utils::DuckUtils.quacks_to?(ret, :cs__tracked?) && ret.cs__tracked?
+              def string_build_event parent_events, patcher, preshift, ret
+                return unless Contrast::Agent::Assess::Tracker.tracked?(ret)
 
+                properties = Contrast::Agent::Assess::Tracker.properties(ret)
                 args = preshift.args
-                if args.length > 1
-                  arg = args[1]
-                  if Contrast::Utils::DuckUtils.quacks_to?(arg, :cs__properties)
-                    arg.cs__properties.events.each do |event|
-                      ret.cs__properties.events << event
-                    end
-                  end
-                end
-                ret.cs__properties.build_event(
+                properties.build_event(
                     patcher,
                     ret,
                     preshift.object,
                     ret,
                     args,
                     2)
+                properties.event.instance_variable_set(:@_parent_events, parent_events)
               end
             end
           end

data/lib/contrast/agent/assess/policy/propagator/trim.rb

@@ -16,9 +16,12 @@ module Contrast
               def tr_tagger patcher, preshift, ret, _block
                 return ret unless ret && !ret.empty?
 
+                properties = Contrast::Agent::Assess::Tracker.properties(ret)
+                return unless properties
+
                 source = preshift.object
                 args = preshift.args
-                ret.cs__copy_from(source)
+                properties.copy_from(source, ret)
                 replace_string = args[1]
                 source_chars = source.chars
                 # if the replace string is empty, then there's a bunch of deletes. this
@@ -41,10 +44,10 @@ module Contrast
                   end
                   # account for the last char being different
                   remove_ranges << (start...source_chars.length) if start
-                  ret.cs__properties.delete_tags_at_ranges(remove_ranges, false)
+                  properties.delete_tags_at_ranges(remove_ranges, false)
                 end
 
-                ret.cs__properties.build_event(
+                properties.build_event(
                     patcher,
                     ret,
                     source,
@@ -57,10 +60,13 @@ module Contrast
               def tr_s_tagger patcher, preshift, ret, _block
                 return unless ret && !ret.empty?
 
+                properties = Contrast::Agent::Assess::Tracker.properties(ret)
+                return unless properties
+
                 source = preshift.object
                 args = preshift.args
-                source.cs__splat_tags(ret)
-                ret.cs__properties.build_event(
+                properties.splat_from(source, ret)
+                properties.build_event(
                     patcher,
                     ret,
                     source,

data/lib/contrast/agent/assess/policy/rewriter_patch.rb

@@ -1,11 +1,11 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/agent/patching/policy/patch_status'
-cs__scoped_require 'contrast/agent/module_data'
-cs__scoped_require 'contrast/agent/rewriter'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/patching/policy/patch_status'
+require 'contrast/agent/module_data'
+require 'contrast/agent/rewriter'
+require 'contrast/components/interface'
+require 'contrast/utils/object_share'
 
 module Contrast
   module Agent

data/lib/contrast/agent/assess/policy/source_method.rb

@@ -1,20 +1,11 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-# This class is responsible for the origination of traces. A Source is any method
-# that returns an untrusted value. In general, these sources are request methods
-# as the request object is user controlled.
-#
-# Going forward, we may add in Dynamic sources (determined at runtime) based on
-# database configs or other variables (used for Stored XSS or other persisted
-# vulnerability detection rules)
-cs__scoped_require 'set'
-
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/sha256_builder'
-cs__scoped_require 'contrast/agent/assess/policy/source_validation/source_validation'
-
-cs__scoped_require 'contrast/components/interface'
+require 'set'
+require 'contrast/agent/assess/policy/source_validation/source_validation'
+require 'contrast/components/interface'
+require 'contrast/utils/object_share'
+require 'contrast/utils/sha256_builder'
 
 module Contrast
   module Agent
@@ -26,7 +17,7 @@ module Contrast
         # dataflows used in Assess vulnerability detection.
         module SourceMethod
           include Contrast::Components::Interface
-          access_component :logging, :analysis
+          access_component :analysis, :logging
 
           PARAMETER_TYPE     = 'PARAMETER'
           PARAMETER_KEY_TYPE = 'PARAMETER_KEY'
@@ -53,38 +44,26 @@ module Contrast
               current_context = Contrast::Agent::REQUEST_TRACKER.current
               return unless current_context&.analyze_request? && ASSESS.enabled?
 
-              replaced_return = nil
               source_node = method_policy.source_node
-
               target = determine_target(source_node, object, ret, args)
+              restore_frozen_state = false
+              if target.cs__frozen? && !Contrast::Agent::Assess::Tracker.trackable?(target)
+                return unless ASSESS.track_frozen_sources?
+                return unless source_node.targets[0] == Contrast::Utils::ObjectShare::RETURN_KEY
 
-              # We don't propagate to frozen things that haven't been tracked
-              # before. By definition, something that is a source has not
-              # previously been tracked; therefore, we can break out early.
-              if target.cs__frozen?
-                # That being said, we don't have enough context to know if we
-                # can make this assumption and still function, so we'll allow for
-                # source tracking of frozen things by a common config setting.
-                #
-                # Rails' StrongParameters make a case for this to be default
-                # behavior
-                return replaced_return unless ASSESS.track_frozen_sources?
-
-                # If we're tracking the frozen target, we need to unfreeze
-                # (dup) it to track and then freeze that result. For
-                # simplicities sake, we ONLY do this if the return is the
-                # target (I don't want to have to deal with unfreezing self)
-                return replaced_return unless source_node.targets[0] == Contrast::Utils::ObjectShare::RETURN_KEY
+                dup = safe_dup(ret)
+                return unless dup
 
                 restore_frozen_state = true
-                ret = Contrast::Utils::FreezeUtil.unfreeze_dup(ret)
+                ret = dup
                 target = ret
+                Contrast::Agent::Assess::Tracker.pre_freeze(ret)
+                ret.cs__freeze
+                # double check that we were able to finalize the replaced return
+                return unless Contrast::Agent::Assess::Tracker.trackable?(target)
               end
-
               apply_source(current_context, source_node, target, object, ret, source_node.type, nil, *args)
-
-              ret.cs__freeze if restore_frozen_state
-              ret
+              restore_frozen_state ? ret : nil
             end
 
             private
@@ -112,34 +91,10 @@ module Contrast
               source_name ||= determine_source_name(source_node, object, ret, *args)
               # We know we only work on certain things.
               # Skip if this isn't one of them
-              if Contrast::Utils::DuckUtils.quacks_to?(target, :cs__properties)
+              if Contrast::Agent::Assess::Tracker.trackable?(target)
                 apply_tags(source_node, target, object, ret, source_type, source_name, *args)
-                # While we don't taint hashes themselves, we may taint the things
-                # they hold. Let's pass their keys and values back to ourselves and
-                # try again
               elsif Contrast::Utils::DuckUtils.iterable_hash?(target)
-                to_replace = []
-                target.each_pair do |key, value|
-                  # We only do this for Strings b/c of the way Hash lookup works.
-                  # To replace another object would break hash lookup and,
-                  # therefore, the application
-                  if can_track_hash_key?(key, target)
-                    key = Contrast::Utils::FreezeUtil.unfreeze_dup(key)
-                    to_replace << key
-                  end
-                  apply_source(context, source_node, key, object, ret, key_type(source_type), key, *args)
-                  apply_source(context, source_node, value, object, ret, source_type, key, *args)
-                end
-
-                # Hash is designed to keep one instance of the string key in it.
-                # We need to remove the existing one and replace it with our new
-                # tracked one.
-                to_replace.each do |key|
-                  key.cs__freeze
-                  value = target[key]
-                  target.delete(key)
-                  target[key] = value
-                end
+                apply_hash_tags(context, source_node, target, object, ret, source_type, *args)
                 # While we don't taint arrays themselves, we may taint the things
                 # they hold. Let's pass their keys and values back to ourselves and
                 # try again
@@ -150,17 +105,81 @@ module Contrast
               logger.warn('Unable to apply source', e, node_id: source_node.id)
             end
 
-            def can_track_hash_key? key, target
+            # While we don't taint hashes themselves, we may taint the things
+            # they hold. Let's pass their keys and values back to ourselves and
+            # try again
+            #
+            # @param context [Contrast::Utils::ThreadTracker] the current request
+            #   context
+            # @param source_node [Contrast::Agent::Assess::Policy::SourceNode]
+            #   the node to direct applying this source event
+            # @param target [Object] the target of the Source Event
+            # @param object [Object] the Object on which the method was invoked
+            # @param ret [Object] the Return of the invoked method
+            # @param source_type [String] the type of this source, from the
+            #   source_node, or a KEY_TYPE if invoked for a map
+            # @param args [Array<Object>] the Arguments with which the method
+            #   was invoked
+            def apply_hash_tags context, source_node, target, object, ret, source_type, *args
+              to_replace = []
+              target.each_pair do |key, value|
+                # We only do this for Strings b/c of the way Hash lookup works.
+                # To replace another object would break hash lookup and,
+                # therefore, the application
+                if replace_hash_key?(key, target)
+                  key = key.dup
+                  to_replace << key
+                end
+                apply_source(context, source_node, key, object, ret, key_type(source_type), key, *args)
+                apply_source(context, source_node, value, object, ret, source_type, key, *args)
+              end
+              handle_hash_key(target, to_replace)
+            end
+
+            # Given an unfrozen hash, if the key is a String, we should replace
+            # it with one that we can finalize, allowing us to track that key.
+            # This method handles checking if that replace can and should
+            # occur.
+            #
+            # @param key [Object] the key in the hash that may need replacing.
+            # @param hash [Hash] the hash to which the key belongs.
+            # @return [Boolean] whether replace the key in the hash or not.
+            def replace_hash_key? key, hash
               ASSESS.track_frozen_sources? &&
+                  !hash.cs__frozen? &&
                   key.is_a?(String) &&
-                  Contrast::Utils::DuckUtils.quacks_to?(target, :delete)
+                  !Contrast::Agent::Assess::Tracker.trackable?(key)
+            end
+
+            # Safely duplicate the target, or return nil
+            #
+            # @param target [Object] the thing to check for duplication
+            def safe_dup target
+              target.dup
+            rescue StandardError => _e
+              nil
+            end
+
+            # Hash is designed to keep one instance of the string key in it.
+            # We need to remove the existing one and replace it with our new
+            # tracked one.
+            def handle_hash_key target, to_replace
+              to_replace.each do |key|
+                Contrast::Agent::Assess::Tracker.pre_freeze(key)
+                key.cs__freeze
+                value = target.delete(key)
+                target[key] = value
+              end
             end
 
             def apply_tags source_node, target, object, ret, source_type, source_name, *args
+              # don't apply tags if we can't track the thing
+              return unless Contrast::Agent::Assess::Tracker.trackable?(target)
               # don't apply second source -- probably needs tuning later if we
               # use more than 'UNTRUSTED' in our sources
-              return if target.cs__tracked? || target.cs__frozen?
+              return if Contrast::Agent::Assess::Tracker.tracked?(target)
 
+              properties = Contrast::Agent::Assess::Tracker.properties(target)
               # otherwise for each tag this source_node applies, create a tag range
               # on the target object
               # I realize this looping is counter-intuitive from the above
@@ -169,16 +188,15 @@ module Contrast
                 next unless Contrast::Agent::Assess::Policy::SourceValidation.valid?(tag, source_type, source_name)
 
                 length = Contrast::Utils::StringUtils.ret_length(target)
-                target.cs__properties.add_tag(tag, 0...length)
-                target.cs__properties.add_properties(source_node.properties)
+                properties.add_tag(tag, 0...length)
+                properties.add_properties(source_node.properties)
                 logger.trace('Source detected',
                              node_id: source_node.id,
                              target_id: target.__id__,
                              tag: tag)
               end
-
               # make a representation of this method that TeamServer can render
-              target.cs__properties.build_event(source_node, target, object, ret, args, source_type, source_name)
+              properties.build_event(source_node, target, object, ret, args, source_type, source_name)
             end
 
             # Find the name of the source